I use Concord Technologies out of Washington. IIRC it's HIPAA compliant.
I believe I pay around $11 per month, but I'm not sure if that's grandfathered in as I've had it a few years.
Really all I use it for is to send faxes to the IRS and state agencies. I never receive faxes.